[PATCH] fuse: prevent exchange/revalidate races

[Miklos Szeredi <mszeredi@redhat.com>]

If a path component is revalidated while taking part in a
rename(RENAME_EXCHANGE) request, userspace might find the already exchanged
files, while the kernel still has the old ones in dcache.  This mismatch
will cause the dentry to be invalidated (unhashed), resulting in
"(deleted)" being appended to proc paths.

Prevent this by taking the inode lock shared for the dentry being
revalidated.

Another race introduced by commit 5be1fa8abd7b ("Pass parent directory
inode and expected name to ->d_revalidate()") is that the name passed to
revalidate can be stale (rename succeeded after the dentry was looked up in
the dcache).

By checking the name and the parent while the inode is locked, this issue
can also be solved.

This doesn't deal with revalidate/d_splice_alias() races, which happens if
a directory (which is cached) is moved on the server and the new location
discovered by a lookup.  In this case the inode is not locked during the
new lookup.

Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
---
 fs/fuse/dir.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 5c569c3cb53f..7148b2a7611a 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -235,9 +235,18 @@ static int fuse_dentry_revalidate(struct inode *dir, const struct qstr *name,
 
 		attr_version = fuse_get_attr_version(fm->fc);
 
+		inode_lock_shared(inode);
+		if (entry->d_parent->d_inode != dir ||
+		    !d_same_name(entry, entry, name)) {
+			/* raced with rename, assume revalidated */
+			inode_unlock_shared(inode);
+			return 1;
+		}
+
 		fuse_lookup_init(fm->fc, &args, get_node_id(dir),
 				 name, &outarg);
 		ret = fuse_simple_request(fm, &args);
+		inode_unlock_shared(inode);
 		/* Zero nodeid is same as -ENOENT */
 		if (!ret && !outarg.nodeid)
 			ret = -ENOENT;
-- 
2.51.0